The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and
6.3.13, when running in verbose mode on platforms for which char is
signed, allows remote attackers to cause a denial of service
(application crash) or possibly execute arbitrary code via an SSL
X.509 certificate containing non-printable characters with the high
bit set, which triggers a heap-based buffer overflow during escaping.
Can we go stable with 6.3.14?
(In reply to comment #1)
> Can we go stable with 6.3.14?
Yes. Please stabilize =net-mail/fetchmail-6.3.14
05 Mar 2010; Torsten Veller <firstname.lastname@example.org> fetchmail-6.3.14.ebuild:
Stable on amd64 (#307761)
Marked ppc stable.
Stable for HPPA.
All arches done
Thanks everyone, GLSA request filed.